Re: [PATCH bpf-next 04/12] bpf: Support __int128 as a by-value function argument

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Out-of-bounds array write in `btf_prepare_func_args()` when an argument takes multiple register slots (like a 16-byte struct or `__int128`) and pushes `slots_used` past `MAX_BPF_FUNC_ARGS`.
--

commit 6ab0b55d70f74022fd34563ec7b71f1a649ea690
Author: Yonghong Song <yonghong.song@linux.dev>

bpf: Support __int128 as a by-value function argument

This commit adds support for 128-bit integers as by-value function arguments
in BPF. It handles __int128 similarly to a 16-byte struct, consuming two
consecutive argument registers.

> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -8251,7 +8247,8 @@ int btf_prepare_func_args(struct bpf_verifier_env *env, int subprog)
>  					i, btf_type_str(t), tname, t->size, 2 * BPF_REG_SIZE);
>  				return -EINVAL;
>  			}
> -			if (!btf_struct_is_composed_of(env, btf, t, BTF_MEMBER_SCALAR)) {
> +			if (btf_type_is_struct(t) &&
> +			    !btf_struct_is_composed_of(env, btf, t, BTF_MEMBER_SCALAR)) {
>  				if (!is_global)
>  					return -EINVAL;
>  				bpf_log(log, "Arg#%d type %s in %s() is not composed of scalars\n",

[Severity: High]
This is a pre-existing issue, but this patch enables __int128 arguments which
trigger the same vulnerable path as 16-byte structs.

Can this loop overflow the sub->args array when an argument takes multiple
slots?

Looking at btf_prepare_func_args() just below this hunk:

			nslots = (t->size + BPF_REG_SIZE - 1) / BPF_REG_SIZE;
			while (nslots--)
				sub->args[slots_used++].arg_type = ARG_ANYTHING;

If a BPF program defines a subprogram with exactly 12 arguments, where the
last argument is a 16-byte struct or __int128, slots_used would be 11 when
processing the final argument.

The 16-byte argument yields nslots = 2. The loop then increments slots_used
twice without checking bounds mid-loop. Because sub->args is sized
MAX_BPF_FUNC_ARGS (12), this writes to sub->args[11] and then out of bounds
to sub->args[12].

Since sub->args sits at the end of struct bpf_subprog_info, immediately
followed by stack_arg_cnt, this out-of-bounds write corrupts stack_arg_cnt.

Later, sub->stack_arg_cnt is set to slots_used - MAX_BPF_FUNC_REG_ARGS,
which rewrites the corrupted enum value. Depending on endianness, this can
result in an invalid enum value triggering a verifier_bug(), or an incorrect
type expectation (like ARG_PTR_TO_CTX instead of a scalar).

Could we add a bounds check inside or before the nslots loop to prevent
slots_used from exceeding MAX_BPF_FUNC_ARGS?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904050957.3976119-1-yonghong.song@linux.dev?part=4